Information processing devices used in a system such as a power plant system and a train car system are provided with a watchdog timer (hereinafter, referred to as WDT) in order to monitor a hung-up of the system due to a software failure. If the timer is not cleared within a predetermined time (time until timeout), the WDT determines that the system has hung up, and resets it. By using the WDT, even when a system failure makes the system nonoperational, the WDT can reset the system to operate it again.
However, in a case where failures frequently occur, the WDT's reset processing for the system results in another failure, thereby repeating the reset processing and leaving the situation unimproved.
To cope with this problem, for example in Patent Document 1, a method is disclosed in which two programs are stored in a ROM (Read Only Memory) so that when a failure occurs to a program, the other program is activated for trying to recover the system.
Patent Document 2 discloses a method in which in accordance with the WDT timeout occurrence count, a selector circuit selects a bootloader used for failure occurrence state as a bootloader to be activated, to output the failure occurrence situation.